News for hackers. Stuff that matters.

A comment on Digital Identity Guidelines: Public Comment Period. Parent comment

Re:Digital Identity Guidelines: Public Comment Period by Freak_NL on Monday March 13, 2017 @06:18AM (#13856543)
Customer service at banks tend to reply "for safety reasons" to any question you pose about their antiquated password limitations. A password limit of 20 characters? That's for safety reasons. Which safety reasons? We can't tell you, because of safety reasons.
[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by AckSyn on Monday March 13, 2017 @07:22AM (#13856814)
> We can't tell you, because of safety reasons

Reminds me of another "security" organization.

[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by mfukar on Monday March 13, 2017 @06:42AM (#13856635)
Just so I know what bank(s) to avoid, which one is (or are) this?
[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by Freak_NL on Monday March 13, 2017 @08:09AM (#13857030)
ING in the Netherlands. Although to be fair, most banks have outrageously backwards password rules, and most limit the maximum length to something like 20 characters.
[ Parent | on HN ]
Re:Digital Identity Guidelines: Public Comment Period by will_hughes on Monday March 13, 2017 @09:21PM (#13864162)
tl;dr: All of them.

Try it, ask your bank why they impose a limit of N characters for their passwords (I bet N is < 30 characters).

You'll almost certainly get a response along the lines of "We follow industry best practice" or something.

[ Parent | on HN ]